Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99096— io_uring/register: don't exempt disabled rings from task restrictions

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： io_uring/register：不再豁免已禁用环形缓冲区（ring）的任务限制 通过 创建的环形缓冲区，在启用之前会豁免其注册限制。这使得创建者可以先注册限制，随后无论 操作码是否在允许列表中，都可以通过该操作码启用环形缓冲区。 自提交 （"io_uring: 允许注册每任务限制"）以来，环形缓冲区还会继承创建它的任务所施加的限制，且上述豁免规则同样适用于这些继承的限制。因此，一个注册操作码受限的任务可以创建一个已禁用的环形缓冲区，在该环形缓冲区上执行任意注册操作码

AI Predicted 7.8 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1548.001 · Setuid and Setgid
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99096

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
io_uring/register: don't exempt disabled rings from task restrictions
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/register: don't exempt disabled rings from task restrictions A ring created with IORING_SETUP_R_DISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS, whether or not that opcode is in the allowed set. Since commit ed82f35b926b ("io_uring: allow registration of per-task restrictions"), a ring also inherits restrictions from the task that creates it, and the same exemption applies to those. A task whose register opcodes are restricted can therefore create a disabled ring, issue any register opcode on it, and then enable it. Mark rings whose restrictions were inherited from the task, and keep checking register opcodes for them while the ring is disabled. Enabling such a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the task's allowed set. Per-ring restrictions registered on a disabled ring work as before. [axboe: amend with inheritance flag fixup]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ed82f35b926b2e505c14b7006473614b8f58b4f4 ~ f55c240192ded562386de843bfa067671d2731d5 -
Linux Linux 7.0 -

II. Public POCs for CVE-2026-99096

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99096

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-10-26 · 12 CVEs total

CVE-2026-99099 x86/CPU/AMD: Fix AMD TLBI Erratum #1718
CVE-2026-99097 tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
CVE-2026-99098 dm-integrity: fix buffer overflow in inline mode with large tag size
CVE-2026-99095 drm/vc4: drain the hangcheck timer and works on V3D unbind
CVE-2026-99094 Bluetooth: btintel_pcie: fix TX descriptor bounds check
CVE-2026-99093 mm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99092 riscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99090 drm/amdgpu: serialize vblank counter reads against GPU reset
CVE-2026-99091 Bluetooth: MGMT: Fix status of pending commands flushed on power off
CVE-2026-99089 ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99088 net: openvswitch: validate transport header presence in set_ipv6_addr

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux